Malicious SIM Cards Can Hijack Smartphones and IoT Devices

Researchers from the University of Birmingham and cybersecurity firm Fuzzware have revealed that malicious or compromised SIM cards can be used to issue commands to smartphones and cellular-connected devices, potentially allowing attackers to steal data, disrupt communications, or even execute code. The findings, presented at the 2026 USENIX WOOT Conference on Offensive Technologies in Baltimore, highlight a significant security risk stemming from a legitimate cellular feature known as Proactive SIM.

The core of the issue lies in a standard capability that allows a SIM card to send instructions directly to a device's modem. Among these is a command that instructs the modem to execute AT commands, a legacy control language dating back to the 1980s. While designed for legitimate operator services, this interface creates a powerful pathway for abuse if the SIM itself is not trusted. Researchers developed a testing toolkit called CATana and examined 26 devices, including 18 smartphones and eight cellular IoT modules used in products like electric vehicle chargers, industrial routers, and connected cars.

The testing revealed that several devices accepted AT commands originating from...